The invention relates to the general field of telecommunications.
It relates more particularly to a technique that provides secure management of access to a service offered by a service provider for a terminal of a user registered with a so-called “internal” network that is secure (i.e. protected by an entity for providing secure access to the network), when that terminal and/or the provider of the service the terminal is attempting to reach is/are located in a so-called “external” network that is distinct from the internal network, and that is potentially not secure.
By way of example, the secure internal network may be a private business network that is protected by a firewall. No limitation is put on the location of the secure network. Thus, the secure internal network could be externalized, typically in a so-called computer “cloud”.
The invention thus applies in advantageous but non-limiting manner to the context of the software-as-a-service (SaaS) model or the infrastructure-as-a-service (IaaS) model.
The SaaS and IaaS solutions are presently undergoing strong growth and they are being developed mainly for use by businesses. These solutions rely on a service provision model that enables businesses to externalize some or all of their information systems. The model also makes it possible for a client or an application that is associated with (i.e. attached to) a business to have easy access to a plurality of internal services (e.g. electronic messaging or video) or services that are external to the business (downloading files or videos, computer virtualization platform), with this being possible at any time and from any terminal.
In this context, it is important to provide effective control of access by the client or of the application attached to the business firstly to the business network and secondly to the service.
When a client attached to a business (e.g. an employee of the business) seeks to access a service authorized by the business via the business's network, solutions are presently available for controlling that access effectively providing the client's terminal is directly connected to the business network. By way of example, such solutions rely on using protocols for authenticating the terminal such as the lightweight directory access protocol (LDAP), the security assertion markup language (SAML2.0), or indeed Kerberos, followed by authorization protocols that make it possible to verify that the terminal is indeed authorized to access the requested service. Those various protocols generally make provision for interrogating a service database maintained in the business network (referred to as a “service directory”) that lists all of the user accounts of the business together with the attributes associated with those users in terms of rights to access the internal or external services that are made available (i.e. authorized) by the business.
Nevertheless, the ever-increasing success and popularity of mobile and/or portable terminals are nowadays making situations more and more frequent in which a client attached to the business seeks to access an internal or external service that is authorized by the business via a wireless telecommunications network such as for example a mobile network, a wireless local area network (WLAN), or a wireless fidelity (WiFi) network that is external to the business network. Such a situation typically occurs when an employee of a business seeks to work remotely, e.g. at home, by making a connection to the secure network of the business (a situation known as “telecommuting”).
Such a situation can also be encountered when an employee of a business seeks to access a service that is authorized by the business, while using an account registered with the service provider in the name of the business (e.g. with an identifier and a password specific to the business and not properly speaking to the employee).
The wireless telecommunications network used by the client or employee terminal for connecting to the internal network of the business and/or for accessing the services authorized by the business is considered as being essentially “non-secure” compared with the internal network of the business, in particular because it is not managed by the business.
Furthermore, on the wireless telecommunications network, the client's terminal may be subjected to attack without its user being aware of them by means of one or more malicious applications that may in particular be seeking to compromise the integrity and the operation of the business network when the terminal accesses it, or to usurp the identifier and the associated password, where appropriate, to the business's account with the service provider(s), and sent by the client via the terminal when attempting to access the service(s) offered by the provider(s).
Solutions exist in the state of the art that propose setting up a secure virtual tunnel between the client's terminal and the business network, in order to enable the terminal to connect to the business network and use the services that it authorizes via a non-secure network and without compromising the security of the business network. Such solutions are also known as virtual private networks (VPNs).
Nevertheless, those solutions are relatively cumbersome for the client in terms of use since they require the client to perform numerous actions such as installing and running a dedicated application on the client's terminal, inputting authentication data that might possibly be synchronized by using a security token, etc., and necessarily requiring the terminal to access the service(s) via the secure tunnel once it has been set up, which can make such access slower.